Dashboards & Visualizations

Problems to drill down Windows path

gfreitas
Builder

Hi people I'm having some issues in a chart drill down that has Windows paths (like: C:\Users\Administrator). When I click in the windows paths to drill down it passes to the next dashboard the variable of the windows path (C:\Users\Administrator) and the search of the next dashboard cannot find any data since splunk search must double back slash to search properly.
If I do a search like: "sourcetype=src1 path="C:\Users\Administrator"" I cannot find any results, but If I search using this: "sourcetype=src1 path:"C:\\Users\\Administrator"" I can find the results. Is there any automatic way to transforms this single back slash into two back slashes (\\) maybe using eval.
Here are some data that may help you understand better:

Log:
date=10:16:08.000 AM 2/7/2014 10:16:08 path="C:\Users\Administrator" file=file.exe risk=High
date=10:12:33.000 AM 2/7/2014 05:39:28 path="C:\Users\Administrator" file=blocker.exe risk=High

Can someone help me?

Tags (2)
1 Solution

gfreitas
Builder

I found how:

instead of doing all in the same search string, I must pipe it to where and trim the directory

| where path=rtrim("$dir$ ")

View solution in original post

afsalkh
New Member

How to achieve this if I want to navigate to a folder path
Consider the result of splunk query
Name| path
Path1 | \abc\p1
Path2 | \abc\p2

I want to click and navigate to the paths .

For weburls i can achieve using $click.value2|n$
But in the case of folders and shared paths how to achieve this???

0 Karma

gfreitas
Builder

I found how:

instead of doing all in the same search string, I must pipe it to where and trim the directory

| where path=rtrim("$dir$ ")

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...